New research shows how known techniques for finding weaknesses in websites are actually practical in uncovering vulnerabilities, for better or worse.
Researchers have long known that they can glean hidden information about the inner workings of a website by measuring the amount of time different requests take to be fulfilled and extrapolating information—and potential weaknesses—from slight variations.
Such “web timing attacks” have been described for years, but they would often be too involved for real-world attackers to utilize in practice, even if they work in theory. At the Black Hat security conference in Las Vegas this week, though, one researcher warned that web timing attacks are actually feasible and ripe for exploitation. James Kettle, director of research at the web application security company PortSwigger, developed a set of web timing attack techniques that can be used to expose three different categories of vulnerabilities in websites. He validated the methods using a test environment he made that compiled 30,000 real websites, all of which offer bug bounty programs. He says the goal of the work is to show that once someone has a conceptual grasp on the types of information web timing attacks can deliver, taking advantage of them becomes more feasible. “I’ve always kind of avoided researching timing attacks because it’s a topic with a reputation,” Kettle says. “Everyone does research into it and says their research is practical, but no one ever seems to actually use timing attacks in real life, so how practical is it? What I’m hoping this work will do is show people that this stuff does actually work these days and get them thinking about it.” Kettle was inspired in part by a 2020 research paper titled “Timeless Timing Attacks,” which worked toward a solution for a common issue. Known as “network jitter,” the paper's moniker refers to time delays between when a signal is sent and received on a network. These fluctuations impact timing measurements, but they are independent of the web server processing measured for timing attacks, so they can distort readings. The 2020 research, though, pointed out that when sending requests over the ubiquitous HTTP/2 network protocol, it is possible to put two requests into a single TCP communication packet so you know that both requests arrived at the server at the same time. Then, because of how HTTP/2 is designed, the responses will come back ordered so that the one that took less time to process is first and the one that took longer is second. This gives reliable, objective information about timing on the system without requiring any extra knowledge of the target web server—hence, “timeless timing attacks.” Web timing attacks are part of a class of hacks known as “side channels,” in which the attacker gathers information about a target based on its real world, physical properties. In his new work, Kettle refined the “timeless timing attacks” technique for reducing network noise and also took steps to address similar types of issues with server-related noise so his measurements would be more accurate and reliable. He then started using timing attacks to look for otherwise invisible coding errors and flaws in websites that are usually difficult for developers or bad actors to find, but that are highlighted in the information that leaks with timing measurements. In addition to using timing attacks to find hidden footholds to attack, Kettle also developed effective techniques for detecting two other common types of exploitable web bugs. One, known as a server-side injection vulnerability, allows an attacker to introduce malicious code to send commands and access data that shouldn't be available. And the other, called misconfigured reverse proxies, allows unintended access to a system. In his presentation at Black Hat on Wednesday, Kettle demonstrated how he could use a web timing attack to uncover a misconfiguration and ultimately bypass a target web application firewall. “Because you found this inverse proxy misconfiguration you just go around the firewall,” he told WIRED ahead of his talk. “It's absolutely trivial to execute once you’ve found these remote proxies, and timing attacks are good for finding these issues.” Alongside his talk, Kettle released functionality for the open source vulnerability-scanning tool known as Param Miner. The tool is an extension for the popular web application security assessment platform Burp Suite, which is developed by Kettle's employer, PortSwigger. Kettle hopes to raise awareness about the utility of web timing attacks, but he also wants to make sure the techniques are being utilized for defense even when people don't grasp the underlying concepts. “I integrated all these new features into Param Miner so people out there who don't know anything about this can run this tool and find some of these vulnerabilities,” Kettle says. “It’s showing people things that they would have otherwise missed.”
Hacking Security Vulnerabilities Hacks Black Hat Defcon
United States Latest News, United States Headlines
Similar News:You can also read news stories similar to this one that we have collected from other news sources.
Timing matters: Study shows ways to improve health alertsWhen seemingly healthy people receive an alert from a wearable sensor telling them they might have a respiratory virus--based on small changes in their unique heartrate, sleep and activity patterns -- what do they do? According to a new study carried out at the height of the COVID-19 pandemic, only a quarter of people follow up such an alert with...
Read more »
Jets confident center Joe Tippmann will figure out timing issuesAaron Rodgers and the Jets were driving during Saturday’s “Green and White” scrimmage when the march was disrupted by a mistake Robert Saleh hopes to correct before the regular season begins.
Read more »
Age & Dark Spots Are Tricky To Treat — 3 Natural Ways The Pros Do ItHow to treat dark spots — without making them worse.
Read more »
Tropical Storm Debby downpours to drench N.J. Latest on timing, track, flood threat.New Jersey got slammed by fierce flooding from thunderstorms Tuesday night. Debby could pour another 7 inches of rain on saturated areas, forecasters say.
Read more »
Hope on the Horizon: Redefining Parkinson’s Progression and Dementia TimingScience, Space and Technology News 2024
Read more »
Tropical Storm Debby NYC weekend impacts: What to know about storm's path and timingDebby will push tropical moisture onshore as it moves north and merges with a stalled front. The flood threat in the northeastern U.S. will increase as rain…
Read more »